Your next credit card might not have any numbers. Here’s why

First, cards went contactless. Now they’re going numberless. Mastercard has revealed plans to entirely remove digits from physical credit and debit cards in Australia, a move the payments giant said would help reduce fraud and minimise consumers’ exposure to mass data breaches.

Global Mastercard executives last week flew to Melbourne to meet the company’s bank and merchant partners and detail its product road map for the next five years.

Key to those plans is an elimination of the traditional 16-digit number from physical credit and debit cards by 2030, which Mastercard chief consumer product officer Bunita Sawhney said would be replaced by tokenisation and biometric authentication.

Mastercard has revealed plans to entirely remove digits from physical credit and debit cards in Australia.Credit: Jim Rice

The first Australian bank is set to announce its deployment of numberless cards on Tuesday. Others are to follow over the next 12 months.

“We don’t want anyone to store that number, and we don’t want to have that piece of information be exposed any more than it needs to be,” Sawhney said.

Bunita Sawhney, Mastercard’s chief consumer product officer.

“You don’t actually need to have it on your physical card. Right now, if you sign up for a subscription for example, you enter your card number and then the recurring payment happens from there. We don’t want to feel like the merchant has to store that 16-digit number and save it in a database that someone could access.”

Customers would still have physical cards for in-person payments, but Mastercard’s plan is for static 16-digit credit card numbers to be replaced by tokens, which would be generated by the customer’s banking app and ensure the customer’s actual card information is never shared.

Tokens are effectively a stand-in number that is saved in a consumer’s phone or watch or on the merchant’s site. A consumer could generate a tokenised card number that works only at Bunnings, for example, or that works only in China for two weeks, if they’re about to travel to China.

“If a criminal gets that card number and tries to use it, it just won’t work,” Mastercard head of security solutions Johan Gerber said. “We’re trying to render the data useless to cyber criminals so there’s just no desire to hack it any more.”

Gerber said Australia was responsible for about a quarter of fraud detected by Mastercard globally.

Fraud rates are seven times higher online than in stores, he said. Criminals routinely exploit exposed card numbers.

Gerber said: “Our investments in security are paying off, but we cannot stop investing. Numberless cards are not going to solve the problem. They are going to make things more secure, but it’s an arms race and the criminals will always find a way. The financial industry is an attractive target, no matter what your motive is. So if we stop investing, then we’ll have a big problem.”

Mastercard is the first major player to set a clear timeline for phasing out traditional card numbers, but Sawhney said others were likely to follow.

“Physical cards will be around for the foreseeable future, but they won’t need to carry the same vulnerabilities as before,” she said.

“We want to ensure that making payments is simple, secure and seamless. By 2030, we envision a world where passwords and printed card numbers are relics of the past.

“We hope our leadership in this space will encourage others to follow suit.”

Mastercard is also adding personalisation options for its digital cards, so that consumers might have a credit card in their Apple Pay or Google Pay wallet themed to their favourite football team or band, for example.

“We know that it’s not only fun, it brings smiles to many people’s faces, but it actually shows a lift in wallet behaviour,” she said. “We see a 15 per cent card spend lift by providing these types of digital personalisation experiences.”

The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.